SEC511: Continuous Monitoring and Security Operations

We heard a lot of stories from history and experience, so perfect there! I just want to say, stories (if funny even better) are the best experience and take away for me at live conference!

Christoph Eckstein, SAMA PARTNERS Business Solutions GmbH

Seth is an energetic engaging teacher with the experience and knowledge to tackle subjects facing SOCs today and make this information relevant-useful.

Mick Leach, Nationwide

We continue to underestimate the tenacity of our adversaries! Organizations are investing a significant amount of time and financial and human resources trying to combat cyber threats and prevent cyber attacks, but despite this tremendous effort organizations are still getting compromised. The traditional perimeter-focused, prevention-dominant approach to security architecture has failed to prevent intrusions. No network is impenetrable, a reality that business executives and security professionals alike have to accept. Prevention is crucial, and we can't lose sight of it as the primary goal. However, a new proactive approach to security is needed to enhance the capabilities of organizations to detect threats that will inevitably slip through their defenses. SEC511: Continuous Monitoring and Security Operations will teach you how to strengthen your skills to undertake that proactive approach.

The underlying challenge for organizations victimized by an attack is timely incident detection. Industry data suggest that most security breaches typically go undiscovered for an average of seven months. Attackers simply have to find one way into most organizations, because they know that the lack of visibility and internal security controls will then allow them to methodically carry out their mission and achieve their goals.

The Defensible Security Architecture, Network Security Monitoring (NSM)/Continuous Diagnostics and Mitigation (CDM)/Continuous Security Monitoring (CSM) taught in this course will best position your organization or Security Operations Center (SOC) to analyze threats and detect anomalies that could indicate cybercriminal behavior. The payoff for this new proactive approach would be early detection of an intrusion, or successfully thwarting the efforts of attackers altogether. The National Institute of Standards and Technology (NIST) developed guidelines described in NIST SP 800-137 for Continuous Monitoring (CM), and day five of this course will greatly increase your understanding and enhance your skills in implementing CM using the NIST framework.

SANS is uniquely qualified to offer this course. Course authors Eric Conrad (GSE #13) and Seth Misenar (GSE #28) hold the distinguished GIAC Security Expert Certification, and both are experienced, real-world, practitioners who apply the concepts and techniques they teach in this course on a daily basis. SEC511 will take you on quite a journey. We start by exploring traditional security architecture to assess its current state and the attacks against it. Next, we discuss and discover modern security design that represents a new proactive approach to such architecture that can be easily understood and defended. We then transition to how to actually build the network and endpoint security, and then carefully navigate our way through automation, NSM/CDM/CSM. For timely detection of potential intrusions, the network and systems must be proactively and continuously monitored for any changes in the security posture that might increase the likelihood that attackers will succeed.

Your SEC511 journey will conclude with one last hill to climb! The final day features a capture-the-flag competition that challenges you to apply the skills and techniques learned in the course to detect and defend the modern security architecture that has been designed. The competition has been designed to be fun, engaging, comprehensive, and challenging. You will not be disappointed!

With your training journey now complete and your skills enhanced and honed, it is time to go back to work and deliver on the SANS promise that you will be able to apply what you learn in this course the day you return to the office.

Notice:

This is a technical course and a laptop is required to perform the hands-on exercises. Also, building and establishing a SOC are outside the scope of this course.

Course Syllabus

SEC511.1: Current State Assessment, Security Operations Centers, and Security Architecture

Overview

The prevention-dominant security model has failed. Given the frequency and extent of significant intrusions, this should not come as a surprise. In order to address the root of the problem, we must understand the current architecture and the design gaps that facilitate the adversary's dominance. What do we need to address to begin to make things better? Can we ever hope to win? What would winning look like? These are important questions that we must answer if we hope to substantially improve our security posture.

We begin with the end in mind, and define the key techniques and principles that will allow us to achieve that state. An effective modern Security Operations Center or Security Architecture must enable an organization's ability to rapidly find intrusions to facilitate containment and response. Both significant knowledge and a commitment to continuous monitoring are required to achieve this goal.

Exercises

Detecting Traditional Attack Techniques

Detecting Modern Attack Techniques

Egress Analysis with ELSA

NetWars (Day 1): Immersive Cyber Challenges

CPE/CMU Credits: 8

Topics

Day 1: Current State Assessment, Security Operations Centers, and Security Architecture

Overview

Traditional Security Architecture

Perimeter-focused

Addressed Layer 3/4

Centralized Information Systems

Prevention-Oriented

Device-driven

Traditional Attack Techniques

Modern Security Architecture Principles

Detection-oriented

Post-Exploitation-focused

Decentralized Information Systems/Data

Risk-informed

Layer 7 Aware

Security Operations Centers

Network Security Monitoring

Continuous Security Monitoring

Modern Attack Techniques

Adversarial Dominance

Frameworks and Enterprise Security Architecture

Enterprise Security Architecture

Security Frameworks

Security Architecture - Key Techniques/Practices

Threat Vector Analysis

Data Exfiltration Analysis

Detection Dominant Design

Zero Trust Model (Kindervag)

Intrusion Kill Chain

Visibility Analysis

Data Visualization

Lateral Movement Analysis

Data Ingress/Egress Mapping

Internal Segmentation

Network Security Monitoring

Continuous Security Monitoring

Security Operations Center (SOC)

Purpose of a SOC

Key SOC roles

Relationship to Defensible Security Architecture

SEC511.2: Network Security Architecture

Overview

Understanding the problems with the current environment and realizing where we need to get to is far from sufficient: we need a detailed roadmap to bridge the gap between the current and desired state. Day two introduces and details the components of our infrastructure that become part of a defensible network security architecture and SOC. We are long past the days where a perimeter firewall and ubiquitous antivirus was sufficient security. There are many pieces and moving parts that comprise a modern defensible security architecture.

In addition to discussing technologies like Next Generation Firewalls, UTM devices, Malware Detonation Devices, SIMs, DLP, and Honeypots that may not be found in all organizations, we will focus on repurposing traditional devices such as layer 3/4 firewalls, routers, switches, and NIDS. The goal of this course is not to give you a long list of items to add to the next year's budget, so we will focus on maximizing the capabilities of your current information security architecture, while pointing out new technologies that may offer a compelling return on investment.

Exercises

ModSecurity

Snort OpenAppId

HoneyTokens for Leak Detection

NetWars (Day 2): Immersive Cyber Challenges

CPE/CMU Credits: 8

Topics

Day 2: SOCs and Defensible Network Security Architecture

SOCs/Security Architecture - Key Infrastructure Devices

Traditional and Next Generation Firewalls, and NIPS

Web Application Firewall

Malware Detonation Devices

HTTP Proxies, Web Content Filtering, and SSL Decryption

SIMs, NIDS, Packet Captures, and DLP

Honeypots/Honeynets

Network Infrastructure - Routers, Switches, DHCP, DNS

Mobile Devices and Wireless Access Points

Threat Intelligence

Segmented Internal Networks

Routers

Internal SI Firewalls

VLANs

Detecting the Pivot

Defensible Network Security Architecture Principles Applied

Internal Segmentation

Threat Vector Analysis

Data Exfiltration Analysis

Detection Dominant Design

Zero Trust Model (Kindervag)

Intrusion Kill Chain

Visibility Analysis

Data Visualization

Lateral Movement Analysis

Data Ingress/Egress Mapping

SEC511.3: Network Security Monitoring

Overview

Designing a SOC or security architecture that enhances visibility and detective capabilities represents a paradigm shift for most organizations. However, the design is simply the beginning. The most important element of a modern security architecture is the emphasis on detection. The network security architecture presented in days one and two emphasized baking visibility and detective capabilities into the design. Now we must figure out how to look at the data and continuously monitor the enterprise for evidence of compromise or changes that increase the likelihood of compromise.

We must first understand the approach and goals of monitoring and define a methodology for analysis. Key terms such as Network Security Monitoring (NSM), Continuous Diagnostics and Mitigation (CDM), and Continuous Security Monitoring (CSM) can cause confusion, and we will make sure these terms are understood, enabling the security professional to guide an organization in using the best practices. Speaking of best practices, we will emphasize the continuous monitoring of the Critical Security Controls.

Enabling continuous monitoring will be studied by developing a model for employing robust NSM. This will allow an organization to deal with and make sense of data to rapidly enable the detection of potential intrusions or unauthorized actions.

Exercises

Pcap Carving with Bro

Sguil Service-Side Analysis

Final Exercise

NetWars (Day 3): Immersive Cyber Challenges Labs

CPE/CMU Credits: 8

Topics

Day 3: Network Security Monitoring

Continuous Monitoring Overview

Defined

Network Security Monitoring (NSM)

Continuous Security Monitoring (CSM)

Continuous Monitoring and the 20 Critical Security Controls

Network Security Monitoring (NSM)

Evolution of NSM

The NSM Toolbox

NIDS Design

Analysis Methodology

Understanding Data Sources

Full Packet Capture

Extracted Data

String Data

Flow Data

Transaction Data

Statistical Data

Alert Data

Tagged Data

Correlated Data

Practical NSM Issues

Cornerstone NSM

Service-Side and Client-Side Exploits

Identifying High-Entropy Strings

Tracking EXE Transfers

Identifying Command and Control (C2) Traffic

Tracking User Agents

C2 via HTTPS

Tracking Encryption Certificates

SEC511.4: Endpoint Security Architecture

Overview

One of the hallmarks of modern attacks is an emphasis on client-side exploitation. The days of breaking into networks via direct frontal assaults on unpatched mail, web, or DNS servers are largely behind us. We must focus on mitigating the risk of compromise of clients. Day four details ways in which endpoint systems can be both more resilient to attack and also enhance detective capabilities.

Exercises

Sysmon

Autoruns

Persistence and Pivoting

Volatile Analysis of Pivoting and Pass-the-Hash

NetWars (Day 4): Immersive Cyber Challenges

CPE/CMU Credits: 8

Topics

Day 4: SOCs and Defensible Endpoint Security Architecture

Security Architecture - Endpoint Protection

Anti-Malware

Host-based Firewall, Host-based IDS/IPS

Application Whitelisting, Application Virtualization

Privileged Accounts, Authentication, Monitoring, and UAC

Whole Disk Encryption

Virtual Desktop Infrastructure

Browser Security

EMET

Dangerous Endpoint Applications

Java

Adobe Reader

Flash

Microsoft Office

Browsers

Patching

Process

To Test or Not to Test

Microsoft

Third Party

SEC511.5: Automation and Continuous Security Monitoring

Overview

Network Security Monitoring (NSM) is the beginning: we need to not only detect active intrusions and unauthorized actions, but also know when our systems, networks, and applications are at an increased likelihood for compromise. A strong way to achieve this is through Continuous Security Monitoring (CSM) or Continuous Diagnostics and Mitigation (CDM). Rather than waiting for the results of a quarterly scan or an annual penetration test to determine what needs to be addressed, continuous monitoring proactively and repeatedly assesses and reassesses the current security posture for potential weaknesses that need be addressed.

The volume of data that must be continuously sought and mined is vast: the goal of continuous monitoring would be out of reach without scripting and automation. Naturally, there are vendors and tools to scratch this itch, but they will be incomplete and require their own care, feeding, and monitoring. Day five describes how to perform continuous monitoring with simple tools and scripts.

Knowing how to script and automate is pointless unless you know what data should be captured and analyzed on a continuous basis. Again leaning on the Critical Security Controls, we will determine high-value targets for continuous monitoring in an enterprise.

SEC511.6: Capstone: Design, Detect, Defend

Overview

The course culminates in a team-based design, detect, and defend the flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week.

Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted all week long. From security architecture, network security monitoring, endpoint security, and continuous monitoring, this challenging exercise will reinforce key principles in a fun, hands-on, team-based challenge.

CPE/CMU Credits: 6

Topics

Day 6: Capstone - Design/Detect/Defend

Security Architecture

Assess Provided Architecture

Continuous Security Monitoring

Using Tools/Scripts to Assess the Initial State

Quickly/Thoroughly Find All Changes Made

Additional Information

Laptop Required

!!IMPORTANT - BRING YOUR OWN LAPTOP CONFIGURED USING THESE DIRECTIONS!!

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system that also can install and run VMware virtualization products. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install VMware Workstation 11, VMware Fusion 7, or VMware Workstation Player 7 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.

MANDATORY SEC511 SYSTEM REQUIREMENTS:

CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Wired Ethernet port (or adapter)

Wireless Ethernet 802.11 B/G/N/AC

USB 3.0 Ports Highly Recommended

Disk: 25 Gigabytes of free disk space

VMware Workstation 11, Workstation Player 7, or Fusion 7 (or newer)

A Linux and Windows 10 Virtual machine will be provided in class

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Utilize tools to support implementation of Continuous Monitoring per NIST guidelines SP 800-137

While the above list briefly outlines the knowledge and skills you will learn, it barely scratches the surface of what this course has to offer. Hands-on labs throughout the course will reinforce key concepts and principles, as well as teach you how to use scripting to automate continuous monitoring. We look forward to seeing you soon!

Hands-on Training

SEC511 employs several different hands-on tactics that go well beyond simple lecture and instructor-led discussions:

Linux-based local labs

Linux-based networked labs

Windows 10-based local labs

Windows 10-based networked labs

Daily Immersive Cyber Challenges (NetWars game engine)

NetWars-based Final Capstone

The meticulously crafted SEC511 Workbook serves as the starting point for hands-on elements in the course. The workbook-driven labs include multiple paths to complete each exercise. This multifaceted approach allows the labs to better accommodate diverse student backgrounds and technical exposure.

A more recent development is the SEC511 Portal/Wiki available within the class virtual environment. The portal provides students with electronic versions of the workbook labs. Even cooler, for most labs the portal includes both an introduction and walkthrough video for each of the workbook-based labs.

Shall we play a game?

The NetWars game engine now permeates every single course day! Since the launch of SEC511, students have consistently found the NetWars-based Final Capstone to be great fun. Who would have guessed that a game would be fun, right? Students' praise did not stop at "fun" - they also found the game to be a tremendously successful way to further their learning. Taking this cue, we have now incorporated a game-style environment into every day, not just day six.

Author Statement

"We are just beginning to accept that every organization can and will be breached. Perimeter-focused preventive security controls have failed. Attackers simply have to find one way into most organizations - the lack of internal security controls then allows them to take their time to achieve their goal.

"This course assesses the current state of security architecture and continuous monitoring, and provides a new approach to security architecture that can be easily understood and defended. What we love most about this course is that when students walk out they have a list of action items in hand to make their organization one of the most effective vehicles for frustrating adversaries. Students are able to assess deficiencies in their own organizations' security architectures and effect meaningful changes that are continuously monitored for deviations from their expected security posture."

- Eric Conrad and Seth Misenar

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.